3

I'm building a password reset system at the moment and I've come across a dilema.

Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they then click on and can reset their password.

However now we want to step away from putting links into email and make customers aware of this to counter phising attacks.

My solution is to create a 5-6 digit pin number and send that in text to a customer via email.

However this feels as though we are increasing security by moving away from links in email but decreasing security by making a security token easier to guess.

Does anyone have any recomendations or views on this?

Improve this question
10
  • 1
    A lot of this sounds rather strange. You create an MD5 hash of what? What's the point of the hash, anyway? The proper way of generating tokens would be to read n random bytes from a source like /dev/urandom and then encode them with a human-friendly format like Base64. And why can't you include this token as plaintext?
    – Fleche
    Commented Jul 2, 2014 at 15:39
  • 1
    I think having them not have to click a link is a good idea. However I would make the password reset workflow very intuitive and convenient. Possibly let them add a phone number so they can receive the token through SMS.
    – Andrew Hoffman
    Commented Jul 2, 2014 at 15:46
  • 1
    +1 for having other options than email to provide reset tokens. You can also introduce security questions to provide the "something you know" combined with "something you have" (something you have being the reset token valid for 2 hours).
    – AlexH
    Commented Jul 2, 2014 at 15:48
  • 3
    The current tokens are actually harmful, because they mix in the password while using an extremely weak hash algorithm. This is an open invitation for an attacker to intercept a token and start a brute-force attack against the password. Whoever wrote this doesn't know what he's doing, so you'll have to replace this either way.
    – Fleche
    Commented Jul 2, 2014 at 16:41
  • 1
    @Fleche & Andrew Hoffman I agree. It's a popular commercial product and that's as it as is. We have removed the user-specific information already and don't currently use it in production.
    – Callum
    Commented Jul 2, 2014 at 17:09

2 Answers 2

Reset to default
3

I agree with @schroeder that password reset emails are one of the areas where it tends to be more acceptable to instruct users to click on links. After all, the user was the one that triggered the password reset and should be expecting an email. You could add text in the email that says "This email was sent due to your request. If you did not request a password reset then do not click this link. Normally you should not click any links in an unexpected email, even if it appears to be legitimate."

The reason I encourage you to reconsider this is because your alternative (using a PIN) is going to be more complicated for users and will likely cause more headaches for you. The PIN complexity aside for a moment, you are going to have to instruct users on what to do, and these instructions will necessitate you telling them where on your site to go to enter the code. While saying "Go to our site home page, click Forgotten Password, and click Enter Reset PIN" isn't rocket science you will still have users complain that they can't find the buttons or otherwise get confused about what to do. Having them simply click on a link eliminates a lot of this confusion.

With regards to PIN complexity you should be able to do a few things to counteract the reduced 'keyspace' of a random 6 digit PIN compared to your hash. You can add in letters and some symbols to bump up the number of possible combinations. You could prompt the user not only for their reset PIN but also their email address (which requires an attacker to guess more than just a valid PIN). You could also add a CAPTCHA or other 'liveness' check to hinder automated guessing at PIN input. Finally, you can monitor PIN reset attempts and block IPs (or otherwise delay them) that submit a large number of guesses.

Just like with a link-based password reset function these PINs should only be valid for a single use and should expire within 30-60 minutes, regardless of whether they are used or not.

By taking steps like these you can eliminate the more likely threats against a PIN-based password reset system.

Improve this answer
1
  • Well I could see it as a commendable step toward training internet users to not get phished. Never trust a link in an email, or never click a link in an email would be sound advice if all password reset moved away from password reset links. Atm its, never trust an email link; unless you're expecting it.
    – Andrew Hoffman
    Commented Jul 2, 2014 at 16:49
2

The token is just to verify that you received the email, that you own the account.

Password reset links in emails are a convenience that provide proof that you own the email account and allow you easy access to the password reset workflow.

These tokens don't have to live anywhere for long term and you can invalidate them after some missed attempts if you feel like it. So you don't need huge entropy the same way MFA tokens don't.

Improve this answer
1
  • 1
    This is what we do. "Link is valid for 2 hours".
    – schroeder ♦
    Commented Jul 2, 2014 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .